\subsection{Hardware Issues}
\smvertspace
Next we describe ways to identify machines that have hardware problems, such as
screen calibration issues, machines with power supply problems, machines that
closed early, and machines that recorded unknown, but possibly severe events.
Analyses such as these can help officials identify machines that may require
maintenance or need to be replaced.  

\smsubsubsection{Calibration Errors}
The first of these analyses detects machines with recurring calibration errors
and machines that had recorded votes while possibly not calibrated.  In the case
of a machine having ballots cast when it is not calibrated, it may not have
correctly captured the voter's intent; if the calibration is inaccurate, a voter
may think they are voting for candidate X, but the machine may record a vote for
candidate Y.  The importance lies not only in the fact that voters' intents may
not be recorded, but also in the possibility that this error may not issue a
warning to the voter when it happens.   

To run this analysis, the event log needs to record a collection of
events; these events include: a machine's screen is not calibrated or
the screen cannot be read, a screen is calibrated by a technician, and
a vote is cast.  In addition, it is not sufficient to have
chronologically ordered events in the log; it is essential that the
events in the event log have accurate date and time stamps.  Our
analysis may need to use the system log to determine the date of
election day because our analysis does not track calibration issues
that occur before election day.  To find the polling location of the
machines used, the ballot images file should also be supplied.  

We detect the calibration errors by finding votes cast after a machine
recorded a bad calibration event and before the screen has been
\textquotedblleft recalibrated.\textquotedblright \hspace{2 mm}  Our
algorithm creates a data structure that keeps track of the machines
that recorded \textquotedblleft Warning - cannot read terminal
screen.\textquotedblright \hspace{2 mm}Next, it checks whether the
technicians calibrated it before or after a vote was cast; it does
this by searching for either \textquotedblleft Vote cast by voter,
\textquotedblright \hspace{1 mm} \textquotedblleft Vote cast by poll
worker, \textquotedblright \hspace{1 mm} or \textquotedblleft Terminal
touch-screen recalibrated.\textquotedblright \hspace{2 mm} If either
of the first two events listed occur before the recalibration event,
then the machine is reported to the election official, as this means
there was at least one vote cast when the machine's screen may not
have been calibrated.  

\smsubsubsection{Power Supply Errors}
The second analysis regarding hardware problems looks for machines with possible power supply issues.  We report machines that experience a higher-than-average number of events related to the Internal Power Supply. One possibility is that these machines have a low battery supply, which could lead to an automatic shutdown.  If a machine shuts down because it no longer has enough power to continue working, the polling location will have fewer machines.  In the case where a polling location has limited resources, it is more likely that there will be long lines of voters waiting to vote; some may leave without voting.  

In order to run this analysis, the event log must contain events related to
power supply or low battery power; having a correct date and time stamp is also
a necessity.  The ballot image file provides the locations of each machine used,
which is essential in this analysis.  By finding the machines with an usually
large number of power supply events, our analysis can report the machines that
have possibly low batteries.  Currently, the publicly available iVotronic
manuals do not describe the meaning of the events that appear in the event log.
Because of this, we had to make some educated guesses about the meaning of each
event.  We interpreted the event, \textquotedblleft Terminal shutdown - IPS
Exit\textquotedblright \hspace{1 mm} as a power supply-related event because IPS
stands for Internal Power Supply~\cite{email2010}.  This analysis keeps track of
every machine in the event log and how many instances of the previously stated
event occur on each machine.  Having a higher-than-average number of this event
type should cause concern because it indicates there was an ongoing problem that
was not solved. A machine with an average number of this event is ignored
because it may be warning about a machine with a low battery, which was then
connected to a power outlet; therefore, it stopped recording this event. This
analysis only recognizes machines with an unusually large amount of this event
type as machines with possible low battery issues. In order to find those
machines, we need to find those that had an unusually high number of IPS
events. Without any prior knowledge of what the \textquotedblleft
normal\textquotedblright \hspace{1 mm} number of events might be, we start by
assuming the number of events seen by any machine will follow a normal
distribution. This is a reasonable assumption because machines that are not
connected to a power supply will likely run low on battery at some point during
the approximately 12 hour day. A few machines may be connected to a power outlet
(causing unusually small numbers of this event) and a few machines may
experience low battery power to the point of automatic shutdown (causing
unusually large numbers of this event).  Assuming a normal distribution, our
analysis calculates the mean and standard deviation of the number of times this
event occurs per machine.  If a machine has an unusually large number of
instances of this event (over three standard deviations above the mean), we
consider it to have power supply issues.

\smsubsubsection{Machines that Closed Early}
We have also developed a way to detect machines that have closed early. A
machine will not shut down before poll closing time unless it is explicitly
closed by a technician or a properly trained poll worker. If a machine is closed
in this manner during election day, there may be something wrong with it
preventing its normal operation.
                  
Event logs that record dates and times accurately, as well as events
that mark a machine being closed for voting, are necessary for this
analysis. Also, it is essential to know the official time when polls
open and close. To help officials take corrective action, we need the
ballot image file to determine the location of the possibly
problematic machines. The event we search for indicates that a machine
was closed early; in the case of the iVotronic it is called:
\textquotedblleft Warning -- Terminal Closed
Early.\textquotedblright \hspace{2 mm} This analysis goes through all
of the events on each machine on election day and searches for this
event. If an occurrence is found between official poll opening and
official poll closing times, the analysis reports the machine that
recorded it to indicate a machine that closed early.  

\smsubsubsection{Anomalous Warnings}
There may be events in the event log that would raise a red flag for election officials. This analysis will report machines that have recorded at least one of these events. The machines that experience these events should be inspected for possible hardware issues; the warning events may indicate an equipment failure or other problem that should be corrected.

Given a set of warning events, this analysis can run on any event logs that record the events in the given set. It would be beneficial to have accurate date and time stamps to narrow the analysis specifically to election day. Additionally, the ballot image file would provide information regarding which machines were used at each polling location.  In the case of the iVotronic, we flagged the following events as warning events: \textquotedblleft Warning -- PEB I/O Flag Set,\textquotedblright \hspace{1 mm} \textquotedblleft Warning -- I/O Flagged PEB will be used,\textquotedblright \hspace{1 mm} and \textquotedblleft Warning -- no valid term audit data.\textquotedblright \hspace{2 mm} Our reasoning was determined by the keyword \textquotedblleft Warning\textquotedblright \hspace{1 mm} as well as by manually analyzing the context in which these events occur in the audit logs. Due to a lack of event descriptions, there may be a set of events that appear to be warnings, but may not require any action. In any case, our analysis searches the event log for the instances of any of the above events that occur on election day and reports the machines that recorded these instances. 
